res is already freed by ldap_parse_reference() (ITS#3190)

servers/slapd/back-meta/search.c

@@ -388,6 +388,7 @@ new_candidate:;
 
 				rc = ldap_parse_reference( lsc->ld, res,
 						&references, &rs->sr_ctrls, 1 );
+				res = NULL;
 
 				if ( rc != LDAP_SUCCESS ) {
 					continue;
@@ -422,9 +423,6 @@ new_candidate:;
 					rs->sr_ctrls = NULL;
 				}
 
-				ldap_msgfree( res );
-				res = NULL;
-
 			} else {
 				rs->sr_err = ldap_result2error( lsc->ld,
 						res, 1 );